Repository navigation
build(deps): bump github.com/gorilla/websocket from 1.4.2 to 1.5.3 - #190
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github.com/gorilla/websocket](https://github.com/gorilla/websocket) from 1.4.2 to 1.5.3. - [Release notes](https://github.com/gorilla/websocket/releases) - [Commits](gorilla/websocket@v1.4.2...v1.5.3) --- updated-dependencies: - dependency-name: github.com/gorilla/websocket dependency-version: 1.5.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Member
pviti
added a commit
that referenced
this pull request
Nov 4, 2026
…ided at payout time, destinations delete and reserves (release v1.8.0) (#191) The gateway (main 161d3ff) now requires a payout destination's minimum deposit as an **explicit answer**: either a figure (`min_amount`) or the flag `no_minimum: true`, exactly one. Neither, or a blank figure, gets 422 `minimum_required`; both get 422 `minimum_conflict`. This PR adds that to the CLI on top of rail0-go#79 (`CreatePayoutDestinationRequest.MinAmount *Uint256String` + `NoMinimum bool`, the same on update, and `PayoutDestination.NoMinimum`). > **Dependency:** needs rail0-go **released with #79**. Until then `go.mod` pins a pseudo-version of an earlier commit on that branch (`4c24316`), and the release guard refuses it. Bump to the tag before merging. ## `rail0 payouts destinations add` - `--min-amount <decimal>` takes the venue's figure, converted with the token's decimals as before. `0` is an ordinary figure, and a negative value is refused up front. - `--no-minimum` means the venue has none. It sends `no_minimum: true` and never a `0`. - **Neither flag:** - on a terminal, the CLI prompts for the minimum, naming the token and network. An empty answer is not accepted; typing `none` states the venue has none. - with `--agent` or no terminal, it is a usage error `minimum_required`, raised before any request, telling you to look up the venue's deposit page. - **Both flags:** usage error `minimum_conflict`, before any request. - The summary shown before the details confirmation states the figure, or `none (no minimum at this venue)`. ## `rail0 payouts destinations update <id>` - `--no-minimum` sends `no_minimum: true`, which removes a figure. - `--min-amount <decimal>` sets a figure and clears the flag. - `--min-amount ""` is refused locally (`minimum_required`). Passing both flags is `minimum_conflict`. - A **change** of the `[figure, no_minimum]` pair asks for the details consent, the same y/N prompt or `--confirm-details` as before. Re-sending the current answer does not, which matches the gateway's comparison. ## Output `list`, `get`, `add`, `update`, `enable`, `disable` and `confirm` print a `minimum` companion field. It is the figure (from `min_amount_formatted`), `none` when `no_minimum` is set, or `not set` for a destination registered before the minimum was asked. Raw fields are unchanged, and `-q` still prints only the id. ## Hints - New hints for `minimum_required` and `minimum_conflict`, naming `--min-amount` / `--no-minimum`. - `payout_destination_minimum_unset` no longer exists in the gateway (destinations with no minimum stated are not blocked), so it has no hint and `send` / `submit` say nothing about it. ## Behaviour change A script that calls `destinations add` without a minimum now gets a usage error. The updated gateway refuses such a request anyway (`minimum_required`). This PR does not mark the change as breaking (no `!`, no footer): decide that when preparing the release. ## Tests In `cmd/payouts_test.go`, against the fake gateway: - `add` with neither flag, with both, or with a negative minimum is refused with the right code, and no request at all is sent. - `--no-minimum` sends `no_minimum: true` and no `min_amount`. `--min-amount 0` sends `"0"` without the flag. The summary is checked for both. - `update --min-amount ""` is refused with no request. `update --no-minimum` needs consent, then sends `no_minimum: true`, no figure and `confirm_details`; re-sending it on a destination that is already `none` sends no `confirm_details`. Both flags give `minimum_conflict` with no request. - The `minimum` field is checked for a figure, `0`, `none` and `not set`, plus through `get`. - The hints are checked. Gate run locally: gofmt, `go build ./...`, `go vet ./...`, `go test ./...`, gendocs drift and the `SOURCE_DATE_EPOCH` clock check, `sh -n install.sh`, `bin/release-prepare-test`. README Payouts section, help text, docs/cli and docs/man are updated. ## Reserves decided at payout time, destinations delete and reserves (rail0-gateway e615989) rail0-go bumped to the rail0-go#79 head 5f91344 (`v1.9.1-0.20261102160918-5f913446474d`, no replace directive). - `payouts destinations add` / `update`: `--reserve` removed — the gateway no longer accepts `reserve_amount` on a destination. **Breaking** for scripts that passed it. Update's "nothing to update" message and the help text follow. - `payouts send` / `prepare`: `--no-refund-reserve` and `--no-gas-reserve` send `keep_refund_reserve` / `keep_gas_reserve: false` for that payout only (a usage error with `--proof`). Unset, nothing is sent and the gateway keeps both (its default). The help says both are kept by default and that skipping one may make a later refund or capture fail. - `send`'s confirmation shows the reserves kept back (or SKIPPED, with the risk) from `GET /payout_destinations/{id}/reserves` (best effort: a failed read leaves the prompt without figures), and for `--amount all` what it comes to now. `submit`'s confirmation shows the `refund_reserve` / `gas_reserve` the prepared payout recorded; `prepare` prints them with the payout. - New `payouts destinations delete <id>`: soft delete behind the same y/N / `--yes` gate as `confirm`; prints the destination with `deleted_at`. - New `payouts destinations reserves <id>`: balance, refund reserve with its refundable-payment count, gas reserve and gas allowance (native-gas chains only), available. `--json` (or a pipe / `--agent`) prints the gateway's record unchanged. - `payouts destinations [list] --include-deleted`. - `insufficient_balance` hint: "after the reserves kept back", pointing at `destinations reserves` and the opt-out flags. - `docs/cli` and `docs/man` regenerated with `tools/gendocs`; README Payouts section updated (new "Reserves (decided at payout time)" section, delete/reserves/--include-deleted). - Tests: add sends no `reserve_amount` and `--reserve` is gone from add/update; reserve flags → request (unset / false / refused with proof); send with `--no-refund-reserve`; the send and submit prompts with the reserves (native gas, non-native, proof); delete gate and DELETE; reserves route, JSON output and terminal view; `--include-deleted` query; command tree. Checks run locally: gofmt, `go build ./...`, `go vet ./...`, `go test ./...`, docs freshness (`go run ./tools/gendocs` + clean diff, also with `SOURCE_DATE_EPOCH`), `sh -n install.sh`, VERSION format, `bin/release-prepare-test` — all pass. golangci-lint is not configured in this repo. ## No destination kind (rail0-gateway be29f83) The kind changed nothing at the gateway and the label already names the venue, so it is gone. - `rail0 payouts destinations add` loses `--kind` (and its completion); docs/cli and man pages regenerated. - rail0-go pinned to the pseudo-version of commercelayer/rail0-go#79 at 4c24316, which drops `Kind` and the `PayoutDestinationKind*` constants. Replace with the tag once rail0-go is released. Gate: `go build`, `go vet`, `go test ./...`, `bin/docs`. ## One destination per payment method Gateway `50e309b`: a wallet has at most one live destination per token and chain. A second address for the same payment method is now `409 payout_destination_exists` (before, only the same address was). The error hint and the delete docs say so: delete the destination to register another address. ## Destination label required and unique Gateway `2a08a95`: `POST /payout_destinations` requires `label` (trimmed; blank is `422 label_required`), unique among the account's live destinations ignoring case (`409 payout_destination_label_taken`); deleting a destination frees its label. `PATCH` may not blank it. - `payouts destinations add`: `--label` is required. Missing or blank (spaces only) is a usage error `label_required` without a terminal or with `--agent`, before any request; on a terminal it is prompted for (blank answers refused). The label is trimmed, sent, and shown in the confirmation summary. - `payouts destinations update --label`: blank is refused locally (`label_required`); the label is sent trimmed. - Error hints for `label_required` and `payout_destination_label_taken`. - Help/Long/Examples, README (new "Label" section) and the generated docs: required, unique per account (ignoring case), freed by `delete`. - Tests: missing/blank label refused with no request, trimmed label sent and shown in the summary, update blank refused / trimmed, hints. Existing `add` tests now pass a label. ## gorilla/websocket 1.4.2 → 1.5.3 (folded in from #190) The Dependabot bump from #190, cherry-picked here so the release ships from one pull request. It is an indirect dependency (`go.mod` and `go.sum` only), and 1.5.3 is the first patched version for the open Dependabot alert (weak PRNG for the WebSocket mask key). Gate after the cherry-pick: gofmt, `go build ./...`, `go vet ./...`, `go test ./...`, `bin/release-prepare-test`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- release:start --> ## rail0 CLI v1.8.0 <!-- release-notes:start --> ### Added - **payouts:** explicit minimum deposit on destinations, reserves decided at payout time, destinations delete and reserves (#191) **Full diff:** v1.7.1...v1.8.0 <!-- release-notes:end --> --- **Version:** **minor**, computed from the pull requests merged since v1.7.1 (a breaking change → major, `feat` → minor, anything else → patch). Decided by: - feat(payouts): explicit minimum deposit on destinations, reserves decided at payout time, destinations delete and reserves (#191) Merging this pull request also releases **v1.8.0**: its changes and the version bump ship together, under the one approval. On the push to `main`, `.github/workflows/release.yml` re-runs CI on the merge commit, creates the tag, and GoReleaser builds the binaries and publishes the GitHub release, and posts the release to Slack. The release notes are the text between the `release-notes` markers above, read from this pull request when it merges: edit them here, before merging. _Opened by `bin/release-prepare`._ <!-- release:end -->
pviti
deleted the
dependabot/go_modules/github.com/gorilla/websocket-1.5.3
branch
November 6, 2026 09:55
This pull request was closed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps github.com/gorilla/websocket from 1.4.2 to 1.5.3.
Release notes
Sourced from github.com/gorilla/websocket's releases.
... (truncated)
Commits
ce903f6Reverts to v1.5.09ec25cafixes broken random value generation1bddf2ebumps go version & removes deprecated module usage750bf92adds GHA & Makefile configsb2c246bRevert " Update go version & add verification/testing tools (#840)"09a6babremoving error handling while closing connections58af150return errors instead of printing to logse5f1a0aexcludes errchecks linterb2a86a1Do not timeout when WriteControl deadline is zero695e909Remove hideTempErr to allow downstream users to check for errors like net.Err...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.